On 15 October 2026, the Financial Stability Board (FSB) published the final version of 12 sound practices for the responsible adoption of AI by banks, insurers and other financial institutions. For any bank building its AI governance, this text becomes an international reference point.
What do the 12 practices cover?
The FSB describes a toolkit that institutions can scale to their size and risk profile and fold into existing cyber and third-party risk frameworks, rather than a new rulebook. Four practices concern the organisation: alignment with strategy and risk appetite, board oversight, clear roles and documented use of AI. Eight follow the lifecycle of each use case:
- assess materiality and risk at inception, then keep reassessing;
- govern data and evaluate model performance;
- address explainability, with compensating controls where a model stays opaque;
- keep human oversight effective;
- manage AI-related cyber risk and dependence on third-party AI providers.
Supervisors are moving to practical questions
According to Reuters, the ECB has asked euro-area lenders to produce plans against AI-enabled cyber threats by the end of October, and to map their AI use, suppliers included, so that systems can be stopped and restarted in a controlled way. In the United States, the Federal Reserve, the OCC and the FDIC are asking how banks would limit or switch off autonomous AI agents, and how their decisions would be audited. In the United Kingdom, supervisors are encouraging the largest banks to strengthen their recovery plans.
The IMF’s Global Financial Stability Report, released on 13 October, also lists cyberattacks and AI among the risks to watch, noting that AI can speed up attack and defence alike.
What does this mean for Moroccan and African banks?
These texts do not apply directly in Morocco. Yet Moroccan and African banking groups work with suppliers, parent companies and partners that are subject to these expectations. The questions now asked in Europe and the United States (who is accountable for a model, how to stop it, how to explain it) will soon become the reading grid of risk committees and auditors here too.
The WePartner view: govern AI without slowing use cases
The 12 practices echo a principle we defend in WeAI: governance is built alongside the first use cases, not after them. In practice, a bank benefits from keeping an inventory of its AI uses, classifying each case by risk level, defining who approves and who can interrupt a system, and training business, risk and compliance teams in a shared language. That is the purpose of AI literacy and training, which drive real adoption far more than the choice of a tool.
Our experience of more than 200 projects, including the digital programmes of four Moroccan banks, shows that the set-ups that last involve business, risk and IT from day one.
A concrete next step
Take your five most advanced AI use cases, including those run by vendors, and test them against the 12 practices: named owner, risk level, human oversight, shutdown plan. The gaps become your governance roadmap. Explore the WeAI offer to structure AI literacy, use cases and deployment.